#!/bin/bash
# Auto-confirm bank withdrawals once the wallet has selected exchange+reserve.
# Required for regional x-taler-bank: confirm wires GOA from user → exchange.
#
# Run once:  auto-confirm-withdrawals.sh
# Loop:      auto-confirm-withdrawals.sh --loop [SECS]
#
# Env:
#   BANK_URL (default http://127.0.0.1:9012)
#   BANK_USER (default explorer) — account that owns the demo withdrawals
#   BANK_PASS or /root/bank-explorer-password.txt / /root/bank-${USER}-password.txt
set -euo pipefail

BANK="${BANK_URL:-http://127.0.0.1:9012}"
USER="${BANK_USER:-explorer}"
LOOP=0
SLEEP=5
if [ "${1:-}" = "--loop" ]; then
  LOOP=1
  SLEEP="${2:-5}"
fi

PASS="${BANK_PASS:-}"
if [ -z "$PASS" ]; then
  for f in "/root/bank-${USER}-password.txt" /root/bank-explorer-password.txt; do
    if [ -f "$f" ]; then PASS=$(tr -d '\n' <"$f"); break; fi
  done
fi
[ -n "$PASS" ] || { echo "no password for $USER" >&2; exit 1; }

token() {
  echo '{"scope":"readwrite"}' > /tmp/acw-tok-req.json
  curl -sS -m 12 -u "${USER}:${PASS}" \
    -H 'Content-Type: application/json' \
    -d @/tmp/acw-tok-req.json \
    "${BANK}/accounts/${USER}/token"
}

# Extract withdrawal IDs we care about:
# 1) public landing withdraw.uri
# 2) any ID passed as args after --loop secs
known_ids() {
  if [ -f /var/www/bank-landing/withdraw.uri ]; then
    basename "$(tr -d '\n' </var/www/bank-landing/withdraw.uri)"
  fi
  # optional list file of UUIDs
  if [ -f /var/www/bank-landing/withdraw-watch.ids ]; then
    cat /var/www/bank-landing/withdraw-watch.ids
  fi
}

confirm_one() {
  local wid="$1"
  local tok="$2"
  local info conf
  info=$(curl -sS -m 10 "${BANK}/withdrawals/${wid}" 2>/dev/null || true)
  [ -n "$info" ] || return 0
  python3 -c "import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if d.get('status')=='selected' else 1)" "$info" 2>/dev/null || {
    st=$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('status','?'))" "$info" 2>/dev/null || echo '?')
    echo "skip $wid status=$st"
    return 0
  }
  echo "confirming $wid ..."
  conf=$(curl -sS -m 15 -o /tmp/acw-conf.out -w '%{http_code}' \
    -X POST \
    -H "Authorization: Bearer ${tok}" \
    -H 'Content-Type: application/json' \
    -d '{}' \
    "${BANK}/accounts/${USER}/withdrawals/${wid}/confirm")
  echo "  HTTP $conf $(cat /tmp/acw-conf.out 2>/dev/null | head -c 200)"
  # re-check
  curl -sS -m 8 "${BANK}/withdrawals/${wid}" | python3 -c "import json,sys; d=json.load(sys.stdin); print('  now', d.get('status'), d.get('amount'))" 2>/dev/null || true
}

once() {
  local tjson tok
  tjson=$(token)
  tok=$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('access_token',''))" "$tjson")
  if [ -z "$tok" ]; then
    echo "token fail: $tjson" >&2
    return 1
  fi
  local ids
  ids=$(known_ids | sort -u)
  if [ -z "$ids" ]; then
    echo "no withdrawal ids to watch"
    return 0
  fi
  while read -r wid; do
    [ -n "$wid" ] || continue
    confirm_one "$wid" "$tok"
  done <<<"$ids"
}

if [ "$LOOP" -eq 1 ]; then
  echo "auto-confirm loop every ${SLEEP}s for user=$USER"
  while true; do
    once || true
    sleep "$SLEEP"
  done
else
  once
fi